91327 – Bash Syslog patch

Bug 91327 - Bash Syslog patch

Summary: Bash Syslog patch

Status:	RESOLVED FIXED

Alias:	None

Product:	Gentoo Linux
Classification:	Unclassified
Component:	[OLD] Core system (show other bugs)
Hardware:	All All

Importance:	High enhancement (vote)
Assignee:	Gentoo's Team for Core System packages

URL:	http://www.nardware.co.uk/Security/ht...
Whiteboard:
Keywords:

Depends on:
Blocks:

Reported:	2005-05-03 09:42 UTC by Kevin Landreth
Modified:	2006-07-14 21:25 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
bash-2.05b patch (bash-2.05b-syslog.patch-2,4.58 KB, patch) 2005-05-03 09:43 UTC, Kevin Landreth	Details \| Diff
Bash-3.0 syslog patch (bash-3.0-syslog.patch,4.15 KB, patch) 2005-05-03 14:15 UTC, Kevin Landreth	Details \| Diff
Corrected patch for bash-3.1 (bash-3.1-bash-logger.patch,2.16 KB, patch) 2006-07-11 12:30 UTC, Victor Nawothnig	Details \| Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Kevin Landreth 2005-05-03 09:42:11 UTC

Original patch by Ant. from HoneyPot.net

This a patch to gentoo (stable) bash-2.05b to enable additional logging via syslog.

Comment 1 Kevin Landreth 2005-05-03 09:43:06 UTC

Created attachment 57941 [details, diff]
bash-2.05b patch

Comment 2 Kevin Landreth 2005-05-03 09:46:41 UTC

http://www.nardware.co.uk/Security/html/bashlogger.htm

Is the ORGIGINAL patch.  I added the #ifdef USE_SYSLOG sectoins in order to use USE flags

Comment 3 SpanKY gentoo-dev

2005-05-03 11:50:14 UTC

(note i havent looked at the patch)

see if it works nicely with bash-3.0-r11 and if it does, re-open

if it doesnt, please find a newer version :)

Comment 4 Kevin Landreth 2005-05-03 14:15:20 UTC

Created attachment 57967 [details, diff]
Bash-3.0 syslog patch

for bash-3.0

Comment 5 Kevin Landreth 2005-05-03 14:15:37 UTC

Updated to work with 3.0

Comment 6 SpanKY gentoo-dev

2005-05-03 22:28:34 UTC

ok, normally i would prefer the autotool version you provided here, but since nothing else touches configure.in, i'd prefer if the patch just always enabled syslog support

so ive stripped down the patch and added it to 3.0-r11 behind USE=bashlogger with a big old warning

if we have patches in the future which touch configure.in/etc..., i'll be sure to grab your patch :)

Comment 7 Charles Tassell 2005-09-14 19:24:00 UTC

Just a note for those not techy enough to read the source code, this patch puts
all logs to local5.info

Comment 8 Kevin Landreth 2005-09-14 19:28:39 UTC

Sorry, yes, it logs to local5 syslog facility

Comment 9 Gert Burger 2006-05-28 23:40:29 UTC

I noticed that this patch does not log non-interactive bash shells, which means that any half-brained person can get around the logging wihtout any issues.

Comment 10 Victor Nawothnig 2006-07-11 12:30:24 UTC

Created attachment 91498 [details, diff]
Corrected patch for bash-3.1

There was a bug in the old patch for 3.1, which caused to seg fault the bash if the command length (including the \n) exceeds 599 chars.
This patch is corrected and working for me, think a confirmation is not necessary.

Changed:
+      syslog(LOG_LOCAL5, LOG_INFO, "HISTORY: PID=%d UID=%d %s(++TRUNC)",
to:
+      syslog(LOG_LOCAL5 | LOG_INFO, "HISTORY: PID=%d UID=%d %s(++TRUNC)",

Comment 11 Victor Nawothnig 2006-07-11 12:34:26 UTC

*** Bug 139043 has been marked as a duplicate of this bug. ***

Comment 12 SpanKY gentoo-dev

2006-07-14 21:25:47 UTC

Comment on attachment 91498 [details, diff]
Corrected patch for bash-3.1

different bug, no point in tracking it here, keep it in Bug 139043